Gheist harvests secrets through malicious GitHub Actions workflows
Wiz tracked more than 13,500 malicious branches on over 850 accounts since September 15, including private enterprise repositories.
76
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenOct 25, 2026
- Last mentioned2d ago
Timeline
3 articles · newest firstGheist used stolen GitHub tokens to steal secrets from 850 accounts
Workflows on more than 13,500 branches logged secrets; public runs were held, while private and Enterprise Server runs completed.
74
Gheist abuses stolen GitHub tokens to dump repository secrets
Wiz found more than 13,500 planted branches on over 850 accounts; public runs are held, but private and enterprise repos still execute.
76
Appears with
- GitHubvendor · 3
- GitHub Enterprise Serverproduct · 3
- GitHub Actionsproduct · 3
- Wizorganization · 2
- Megalodonmalware · 1
- PolinRidermalware · 1
- Wiz Researchorganization · 1
- Trivyproduct · 1
- Amazon Web Servicesorganization · 1
- AWS Secrets Managerproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.